How to do a Risk Analysis

Overview: If you cannot remember the last time your organization performed a HIPAA & HITECH Act Risk Analysis, or if you are unsure if your organization has ever performed a Risk Analysis, then this is the webinar for you. Jonathan P. Tomes will cover how to conduct a risk analysis and how to update it as necessary. Failure to conduct a written risk analysis qualifies as "willful neglect," which carries the highest civil money penalty ("CMP") and which penalty cannot be waived by DHHS as can violations due to a reasonable cause.

Because a risk analysis is a required implementation specification under the Security Rule, failure to do one is willful neglect.
And the civil money penalties are not the only sanctions for not doing a risk analysis. The remediation costs for a breach that might have been prevented had a risk analysis been done can be much more than the CMP. Blue Cross Blue Shield of Tennessee not only had to pay the $1.5 million settlement, but also it incurred $17 million in remediation costs-costs that might have been avoided had it done an updated risk analysis.

Why should you attend: The majority of the DHHS civil money penalties and settlements in lieu thereof involve, sometimes with other violations, failure to perform a written risk analysis. These penalties usually are in the seven figure range. Blue Cross Blue Shield of Tennessee, for example, settled for $1.5 million for failing to update its risk analysis when its physical security situation changed. Other seven-figure settlements involved failure to do the required initial risk analysis.

Areas Covered in the Session:

What is risk analysis?

Why do you need to do one?

How to do one

Assemble a good team

Identify assets

Identify risks

Quantify risks

Select reasonable, appropriate, and cost effective security measures

Test and revise security measures

Particular areas to focus on (portable devices, social media, email, and the like)

Case study (will walk webinar attendees through the process)

Questions and answers

Who Will Benefit:

HIPAA compliance Officers

HIPAA Security Officers

HIPAA Privacy Officers

Human Resources Directors

Business Office Managers

Medical Records Personnel

Health Care Attorneys

Patient Accounts Managers

Business Associates

Training Options

Duration: 90 Minutes

RecordedAccess recorded version only for one participant; unlimited viewing for 6 months ( Access information will be emailed 24 hours after the completion of live webinar)Price: $225.00

Overview: If you cannot remember the last time your organization performed a HIPAA & HITECH Act Risk Analysis, or if you are unsure if your organization has ever performed a Risk Analysis, then this is the webinar for you. Jonathan P. Tomes will cover how to conduct a risk analysis and how to update it as necessary. Failure to conduct a written risk analysis qualifies as "willful neglect," which carries the highest civil money penalty ("CMP") and which penalty cannot be waived by DHHS as can violations due to a reasonable cause.

Because a risk analysis is a required implementation specification under the Security Rule, failure to do one is willful neglect.
And the civil money penalties are not the only sanctions for not doing a risk analysis. The remediation costs for a breach that might have been prevented had a risk analysis been done can be much more than the CMP. Blue Cross Blue Shield of Tennessee not only had to pay the $1.5 million settlement, but also it incurred $17 million in remediation costs-costs that might have been avoided had it done an updated risk analysis.

Why should you attend: The majority of the DHHS civil money penalties and settlements in lieu thereof involve, sometimes with other violations, failure to perform a written risk analysis. These penalties usually are in the seven figure range. Blue Cross Blue Shield of Tennessee, for example, settled for $1.5 million for failing to update its risk analysis when its physical security situation changed. Other seven-figure settlements involved failure to do the required initial risk analysis.

Areas Covered in the Session:

What is risk analysis?

Why do you need to do one?

How to do one

Assemble a good team

Identify assets

Identify risks

Quantify risks

Select reasonable, appropriate, and cost effective security measures

Test and revise security measures

Particular areas to focus on (portable devices, social media, email, and the like)

Case study (will walk webinar attendees through the process)

Questions and answers

Who Will Benefit:

HIPAA compliance Officers

HIPAA Security Officers

HIPAA Privacy Officers

Human Resources Directors

Business Office Managers

Medical Records Personnel

Health Care Attorneys

Patient Accounts Managers

Business Associates

Jonathan P. Tomes , J.D., is a health care attorney and partner in the law firm of TOMES & DVORAK, CHARTERED. He has written more than 50 books, including The Compliance Guide to HIPAA and the DHHS Regulations, and dozens of articles in the area of HIPAA compliance.

He has been an expert witness in litigation involving health information compliance issues and is the President of EMR Legal, Inc., a national HIPAA consulting firm. His knowledge of the law and of the practical aspects of setting up a security system provides a rare opportunity for compliance officers and medical records veterans and novices alike. Mr. Tomes has presented seminars nationally for 20 years.